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Abstract 

Reliable communication imposes an upper limit on the achievable rate, namely the Shannon capacity. 
Wyner’s wiretap coding, which ensures a security constraint also, in addition to reliability, results in 
decrease of the achievable rate. To mitigate the loss in the secrecy rate, we propose a coding scheme 
where we use sufficiently old messages as key and for this scheme prove that multiple messages are 
secure with respect to (w.r.t.) all the information possessed by the eavesdropper. We also show that we 
can achieve security in the strong sense. Next we consider a fading wiretap channel with full channel 
state information of the eavesdropper's channel and use our coding/decoding scheme to achieve secrecy 
capacity close to the Shannon capacity of the main channel (in the ergodic sense). Finally we also 
consider the case where the transmitter does not have the instantaneous information of the channel state 
of the eavesdropper, but only its distribution. 
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1. Introduction 

With the advent of wireless communication, the issue of security has gained more importance 
due to the broadcasting nature of the wireless channel. Wyner OJ proposed a coding scheme 
to implement security at physical layer for a degraded wiretap channel, which is independent 
of computational capacity of the adversary. The result of Wyner was generalized to a more 
general broadcast channel f2]]. More recently, the growth of wireless communication systems 
has intensified the interest in implementing security at physical layer (0,0, ff5l). 

There is a trade-off between the achievable rate and the level of secrecy to be achieved. In 
particular, in the coding scheme which achieves the secrecy capacity in a discrete memoryless 
wiretap channel, the eavesdropper (Eve) is confused with the random messages at a rate close 
to Eve’s channel capacity, thus resulting in loss of transmission rate 00], (2]]. 

Considerable progress has recently been made to improve the achievable secrecy rate of a 
wiretap Channel. In @ a wiretap channel with rate-distortion has been studied, wherein the 
transmitter and the receiver have access to some shared secret key before the communication 
starts. Secret key agreement between the transmitter (Alice) and the legitimate receiver (Bob) 
has been studied extensively in literature (B7]]-ff8]]). When Alice and Bob have access to a public 
channel, the authors in 0 and @ proposed a scheme to agree on a secret key about which the 
adversary has less information (leakage rate goes to zero asymptotically). 

In ifTOTl the authors have considered the wiretap channel with secure rate limited feedback. 
This feedback is used to agree on a secret key, and the overall secrecy rate is enhanced. Under 
some conditions, the secrecy rate achieved can be equal to the main channel capacity. In IfTTlI the 
authors have considered a modulo-additive discrete memoryless wiretap channel with feedback. 
The feedback is transmitted using the feed-forward channel only. The feedback signal can be 
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used as a secret key. The authors propose a coding scheme which achieves secrecy rate equal 
to the main channel capacity. Wiretap channel with a shared key was studied in lfl2ll . 

Fading wiretap channel was studied in lfl3Tl . Ifl4l and |[T5ll . In lfT6l . previously transmitted 
confidential messages are stored in a secret key buffer and used in future slots to overcome the 
secrecy outage in a fading wiretap channel. In this model the data to be securely transmitted 
is delay sensitive. In IfTTlI the authors also use previously transmitted bits and store in a secret 
key buffer to leverage the secrecy capacity against deep fades in the main channel. The authors 
prove that all messages are secure w.r.t. all the outputs of the eavesdropper. The secrecy rate is 
not enhanced but prevented to decrease when the main channel is worse than the eavesdropper’s 
channel. A multiplex coding technique has been proposed in lfT8il to enhance the secrecy capacity 
to the ordinary channel capacity. The mutual information rate between Eve’s received symbols 
and the (single) message transmitted is shown to decrease to zero as codeword length increases. 

In most of the work cited above the security constraint used is weak secrecy where if the 
message to be confidentially transmitted is W and the information that eavesdropper gets in n 
channel uses is Z n , then /(IE: Z" ) < ne. From stringent security point of view, this notion is 
proved to be vulnerable for leaking some useful information to the eavesdropper 0. Maurer in 
If9ll provided a coding scheme combined with privacy amplification and information reconciliation 
that achieves secrecy capacity (same as in the weak secrecy case) with a strong secrecy constraint, 
i.e., I(W ; Z n ) < e. There are other ways to achieve strong secrecy (see chapter 21 in Ifl9ll . |[20ll 
and If2l]| ). 

In this paper, we consider a time slotted wiretap channel. The messages transmitted in a slot 
are used as a key to encrypt the message in the next slot of communication. Simultaneously, we 
use the wiretap encoder for another message in the same slot, which enhances the secrecy rate. 
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We ensure that in each slot the currently transmitted message is secure with respect to (w.r.t.) 
all the output that Eve has received so far. 

In next part of this paper we extend this work to the wiretap channel with a secret key buffer, 
where the key buffer is used to store the previously transmitted secret messages. In this scheme 
we use the oldest messages stored in the key buffer as a key in a slot and then remove those 
messages from the key buffer (a previous message is used as a key only once). In each slot 
this key is used along with a wiretap encoder to enhance the secrecy rate. With this, not only 
the current message but all the messages sent in recent past are jointly secure w.r.t. all the data 
received by Eve till now. We also study a slow fading wiretap channel with the proposed coding 
scheme. We show that the water-filling power control along with our coding scheme provides 
the secrecy capacity close to Shannon capacity. 

We also show that if resolvability based coding scheme GTTl is used instead of wiretap coding 
in a slot, then we can achieve secrecy capacity equal to the main channel capacity in the strong 
sense also. 

Rest of the paper is organised as follows. Channel model and the problem statement are 
presented in Section [2} Section [3] provides our coding and decoding scheme and shows that it 
can provide Shannon capacity for an AWGN wiretap channel. Section 0] extends it to a fading 
wiretap channel with Eavesdropper’s channel information at the transmitter while section [5] 
provides the results when this information is not available at the transmitter. Section [6] concludes 
this paper. 

A note about the notation. Capital letters, e.g., W will denote a random variable and the 
corresponding small letter w its realization. An n-length vector (A\. A 2 ,..., A n ) will be denoted 
as A. Information theoretic notation will be same as in Il22ll . 
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2. Channel Model and Problem Statement 



Fig. 1. Wiretap Channel with secret key buffer 


We consider a discrete time, memoryless, degraded wiretap channel, where Alice wants to 
transmit messages to Bob. We want to keep Eve (who is passively ’’listening”) ignorant of the 
messages (Fig. 1). 

Formally, Alice wants to communicate messages W £ W = (1, 2,..., 2 nRs } reliably over 
the wiretap channel to Bob, while ensuring that Eve is not able to decode them, where R s , 
the secrecy capacity is defined below. W is distributed uniformly over W. At time i. A 7 , is 
the channel input and Bob and Eve receive the channel outputs Y t and Z % respectively, where 
Xi e A. Y, 6 y,Zi £ Z. The transition probability matrix of the channel is p(y,z\x). The 
secrecy capacity (HD) 

R s = max [/(A; Y) — /(A"; Z)\ , (1) 

p{x) 

is assumed > 0. 

We consider the system as a time slotted system where each slot consists of M + 1 minislots 
and one minislot consists of n channel uses; M being a large positive integer. We are interested 
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in transmitting a sequence { W m , rri > 1} of iid messages uniformly distributed over W. Let 
C be the capacity of Alice-Bob channel and [x] denote the integer part of x. For simplicity, 
we take jf as an integer. The message W k to be transmitted in slot k consists of one or more 
messages W m . The codeword for message W k is denoted by X k . The corresponding received 
bits by Eve are Z k . To increase the secrecy rate, the transmitter uses previous messages as keys 
for transmitting the messages in a later slot. 

We will denote by P e the probability that any of the messages transmitted in a slot is not 
received properly by Bob: P]' 0 = Pr(W k f W k ) where W k is the decoded message by Bob in 
slot k. 

For secrecy we consider the leakage rate 

— I{Wki W k - 1 , • • • , wk-Nd Z\, • • • , Zk) ( 2 ) 

n 


in slot k where N\ is an arbitrarily large positive integer which can be chosen as a design 
parameter to take into account the secrecy requirement of the application at hand Lj. Then of 
course we should be considering k > N\ .This means that the Eve at time k is not interested in 
very old messages transmitted before slot k — N\. 


Definition 2.1. Rate R is achievable if there are coding-decoding schemes for each n such that 
P e (n) 0 and ±I(W k ,...,W k _,v,; Zi,..., Z k ) —)■ 0 as n —* oo, where N\ is an arbitrarily 
large fixed constant. 

In the following we explain our coding scheme. The message W k transmitted in slot k is 


One motivation for this is the law in various countries where old secret documents are declassified after a certain number of 
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stored in a key buffer (of infinite length) for later use as a key. After certain bits from the key 
buffer are used as a key for data transmission, those bits are discarded from the key buffer, not 
to be used again. Let B k be the number of bits in the key buffer at the beginning of slot k. Let 
Rk be the number of key bits used in slot k from the key buffer. Then 

Bk+i = Bk + \W k\ — Rk (3) 

where \W k \ denotes the number of bits in H 7 /,.. Now we explain the coding-decoding scheme 
used in this paper. 

A. Encoder: 

To transmit message W k in slot k, the encoder has two parts 

f a : W -A X n , f d : W M X K -A X nM , (4) 

where K is the set of secret keys generated and f s is the wiretap encoder, as in |[Tj]. We use the 
following encoder for fd : Take binary version of the message and XOR with the binary version 
of the key. Encode the resulting encrypted message with an optimal usual channel encoder (e.g., 
an efficient LDPC code). 

Assume B 0 = 0. The case of B 0 > 0 can be easily handled in the same way. In the first slot 
message W\ — W\, encoded using the wiretap coding only is transmitted (we use only the first 
minislot, see Fig. 0) . At the end of slot 1, nR s bits of this message are stored in the key buffer. 
Thus Bi = R s n. In slot 2, message W 2 consisting of two messages (W 2 1 , W 22 ) = (W 2 , W 3 ) are 
transmitted. W 2 is transmitted via wiretap coding and W 3 uses IL] as a key and the encrypted 
message Wi © W 3 is transmitted via a usual capacity achieving channel code. At the end of 
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slot 2, R s n bits of II'] are removed from the key buffer and 2 R s n bits of W 2 are stored in the 
key buffer. Since Bob is able to decode W i with a large probability, but not Eve, W i can be an 
effective key in slot 2. In slot 3, message W 3 consisting of 3 messages from the source message 
sequence are transmitted: one message in the first mini slot denoted as W :i j via wiretap coding 
and two messages denoted together as W 3t2 via encryption with message W 2 as key bits. In any 
mini-slot we can transmit upto C/R s messages via encryption with a key. This is because we 
cannot transmit reliably at a rate higher than Bob’s capacity C. Thus, the maximum number of 
messages that can be transmitted in a slot is 1 + 4f-M = M\. Once we reach this limit, from 
then onwards M\ messages will be transmitted in a slot providing the achievable rate ^t+i^ 
which can be made as close to C as we wish by making M arbitrarily large. 

Consequently, in slot k < , k messages from the source message stream are transmitted, 

(k—l)R s n bits from the key buffer are removed in the beginning of slot k and kR s n bits are added 
to the key buffer at the end of slot k. The overall message is denoted by W k = (Wk, i, W k , 2 ) 
with W k} 1 consisting of one source message transmitted via wiretap coding and W k ^ 2 consisting 
of k — 1 messages transmitted via the secret key. From slot M\ onwards M\ messages are 
transmitted in the above mentioned fashion. 

We use the key buffer as a first in first out (FIFO) queue, i.e., at any time the oldest key bits 
in the buffer are used first. Also B k —y 00 as k —> 00 . 

Decoder 

We have a secret key buffer at Bob’s decoder also that is used in the same way as at the 
transmitter. The confidential messages decoded by the decoder are stored in this buffer. For 
decoding at Bob, in slot 1 the usual wiretap decoder is used (say, a joint-typicality decoder). 
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Fig. 2. Coding Scheme to achieve Shannon Capacity in Wiretap Channel 

From slot 2 onwards, for the first mini-slot, we use the wiretap decoder while for the rest of the 
mini-slots, we use the channel decoder (corresponding to the channel encoder used) and then 
XOR the decoded message with the key used. 

The above coding-decoding schemes ensure that Pe —> 0 as n —> oo. There is a small 
issue of error propagation due to using the previous message as key: Let e n be the message 
error probability for the wiretap encoder and let 5 n be the message error probability due to the 
channel encoder for W k - Then e n —* 0 and <) n —t 0 as n —t oc. For the k th slot, we have 
P(W k 7 ^ if 7 /,) < Pr {Error in decoding W ki) + Pr(Error in decoding if 7 /, 9 ) + Pr (Error in 
decoding W k ~i) < ke n + (k — l)S n . Thus the error increases with k. But restarting (as in slot 
1 ) after some large k slots as in slot 1 (i.e., again start with one message in the first minislot 
and no message in the rest of the slot) will ensure that P{W k ^ 144) —> 0 as n —> 00 . 

In the rest of the paper we show that our coding scheme provides an achievable rate with the 
above secrecy criterion as close to C as needed, for all k large enough. We also note that the 
following proof is valid for Ni > 1. The proof for N\ = 1 is different from the proposed proof 
and one can refer to ll23Tl for details of the proof. We will denote the codeword X k = (X ki i, X k 2 ) 
and Z k = (Z kA . Z k 2 ) for the data received by Eve in the first part and the second part of slot 
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k. 


3. Capacity of Wiretap Channel 


Theorem 3.1. The secrecy capacity of our coding-decoding scheme is C and it satisfies (0) for 
any N\ > 0, for all k large enough. 

Proof: As mentioned in the last section, by using our coding-decoding scheme, using wiretap 
coding and secure key, in any slot k, Bob is able to decode the message W k with probability 

Pe' l) —» 0 as n —> oo. 

Fix iV!>0 and a small e > 0. Due to wiretap coding, we can choose n such that I(W k ,i\ z k,i ) < 
ne for all /;: > 1. Since the key buffer B k —> oo, we use the oldest key bits in the buffer first 
and in any slot do not use more than MC key bits, after sometime (say N 2 slots) for all 
k > N 2 we will be using key bits only from the messages W i, W 2 ,..., Wk-^-i for messages 
W k , W k _ i,..., W fe _jvi. Furthermore, 


i{W k ,W k - u .. 

■, W k-Nd z i,... 

> Zk) 


= i(W kA ,W k . 

-i,i 5 • ■ ■ j W k - jvi,i; 

• Z\,... , Z k ) 


+ I(w k , 2 ,... 

, W k - N 1} 2', Z i, . . 

• j Z k \W k ,i, ■ ■ ■, W k-N !,i)- 

(5) 


We show in Lemma 1 that 


I(Wk,i, W k- 1,1, • • •, W k-N-iXi z h ■ ■ ■ i z k) < (^i + 1 )Tie, 


and in Lemma 2 that 


( 6 ) 
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(7) 


From ©, © and © 


1 



( 8 ) 


n 


By fixing iV :1 , we can take e small enough such that (Ni + l)e is less than any desired value. 

□ 

So far we have been considering an infinite buffer system. But an actual system will have a 
finite buffer. Now we compute the key buffer length needed for our system. 

If we fix the probability of error for Bob and the upper bound on equivocation, then we can 
get the code length n needed. Also, from the secrecy requirement, we can fix Ni. Once n and 
Ni are fixed, to ensure that eventually, in slot k we will use a key from messages before time 
k — Ni, the key buffer size should be > CMN x n bits. Also, since in each slot, the key buffer 
length increases by nR s bits, the key buffer will have at least CMNin bits after slot CA I [ N ' ■ In 
the finite buffer case eventually key buffer will overflow. We should loose only the latest bits 
arriving in any slot (not the bits already stored). 

We can obtain Shannon capacity even with strong secrecy. For this instead of using the usual 
wiretap coding of Wyner in the first minislot of each slot we use the resolvability based coding 
scheme m. Then I(\Vky] Z^ i) A e instead of I{\VZ^ i^ A nr for n large enough. Then 
from proof of Theorem 1, our coding-decoding scheme provides 


I(Wk, ■ ■ ■) Wk~ N iJ Zi ,..., Z k ) < e. 


(9) 
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4. AWGN Slow Fading Channel 

We consider a slow flat fading AWGN channel (Fig. 1), where the channel gains in a slot are 
constant. The channel outputs are, 


Yi =H Xi + N lu 


GO) 


Z t =G Xi + N 2i , 


( 11 ) 


where X t is the channel input, {Nu} and { N 2 ,} are independent, identically distributed ( i.i.d .) 
sequences independent of each other and {A,} with distributions J\f(0, af) and A/’(0, cr|) respec¬ 
tively, and J\f(a, b) denotes Gaussian distribution with mean a and variance b. Also II and G are 

rv . . 

the channel gains to Bob and Eve respectively in the given slot. Let H = \H\ 2 and G = \G\~. 

The channel gains H k and G k in slot k are constant and sequences {///,, k > 0} and { G k , k > 
0} are iid and independent of each other. We assume that (H k ,Gk) is known at the transmitter 
and Bob at the beginning of slot k. The notation and assumptions are same as in Section 3. 
Power P(H k , G k ) is used in slot k for transmission. There is an average power constraint, 

k 

lim sup \ Yl E [ p ( H k, Gk )] < P. (12) 

k —^oo ^ , 

m= 1 

Given H kl G k , and B k at the beginning of slot k, Alice needs to decide on P(H kl G k ) and 
R k such that the resulting average transmission rate lim sup hco ■ Ym=i r i > s maximized subject 
to (fT2l) . © and P" 0, where r k is the transmission rate in slot k. We compute this capacity 
for P(H k > G k ) > 0; otherwise, the capacity is zero. At the end of slot k, n(M + l)r/, = r k 
bits are stored in the key buffer for later use as a key while R k bits have been removed. Thus, 
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the buffer size evolves as, 


Bk +1 Bk T r k Rk- 


(13) 


For convenience, we define 


C(P(H,G )) 




HP(H,G)\ 
*1 )' 


(14) 


and 

C e (P(H,G)) = bog (l + GP( ^’ G) ) ■ (15) 

where P(H, G) is the power used when the channel gains are H and G. Unlike Sections II 
and III where initial messages W are with cardinality 2 nRs , we use adaptive coding and power 
control. Then, we have the following theorem. 


Theorem 4.1. The secrecy rate 


C s = E h [C(P(H ))] (16) 

is achievable if Pr(II k > Gjf) > 0, where P(H) = P(H, G) is the water-filling power policy 
for Alice —> Bob channel. 

Proof: We follow the coding-decoding scheme of Section-l3] with the following change to 
account of the fading. 

Each slot has M + 1 mini-slots. We fix a power control policy P(H, G) satisfying average 
power constraint. We transmit for the first time when H k > G k and use wiretap coding in all 
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the (M + 1) minislots. We store all the transmitted bits in the key buffer also. 

From next slot onwards, we use the first mini-slot for wiretap coding (if H k > G k ) and rest of 
the mini-slots for transmission via secret key (if H k < G k use only M minislots for transmission 
with secret key in slot k and do not use the first minislot, with R k = min (B k . MC(P(H k , G k ))n). 
In every slot we remove R k bits and add r k > R k bits to the key buffer. Since Pr ( H k > G k ) > 0, 
Pr(f k > Rk) > 0. Thus B k oo a.s. and eventually, in every slot we will transmit in the first 
mini-slot at rate 

[C ( P(H k , G k )) - C e (P(H k , G k ))] + (17) 

and in the rest of the mini-slots at rate C ( P ( II k ■ G k )) with arbitrarily large probability. 

The average rate in a slot can be made as close to C (P(II k . G k )) as we wish by making M 
large enough. Thus, the rate for this coding scheme is maximized by water filling. 

Now we want to ensure that for k large enough, for messages (W fc , W k _ i,..., W k _ Nl ) we 
use only keys from (Wi,..., Wk-^-i) ■ It can be ensured if we do not use more than M 
key bits in a slot and from k — N\ onward the key queue length > MNi bits, where the 
constant M can be chosen arbitrarily large. Thus we modify the above scheme such that we 
use min (B kl M, nMC(P(H k ))) key bits in a slot instead of min (B k ,nMC(P(H k ))) bits. By 
making M as large as needed, we can get arbitrarily close to the water filling rate. ■ 

Strong secrecy can be achieved as for the non-fading case in Scction-[3] Also, to attain the 
required reliability and secrecy, the key buffer length required can be obtained as in Section [3] 
by using M (defined in the proof of Theorem 2). 
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5. Fading Wire-tap With no CSI of Eavesdropper 

In this section we assume that the transmitter knows only the channel state of Bob at time k 
but not Gk, the channel state of Eve. This is more realistic because Eve is a passive listener. Now 
we modify our fading model. Instead of (Hk, Gk) being constant during a slot (slow fading), 
the coherence time of ( H k , Gk) is much smaller than the duration n of a minislot. Then we 
can use the coding-decoding scheme of lTT3tl in the first minislot with secrecy rate R s and 
I{WkXi z 1 , ■ ■ ■, Zk) < ne, where 

( 18 ) 

Now we have the following proposition 


R s — 2 ^ h ’ g 


log 




OT 


log 1 + 


GP(H) 




Proposition 5.1. Secrecy capacity equal to the main channel capacity without CSI of Eve at the 
transmitter 


C 





HP(H)\ 1 
*1 )\ 


(19) 


is achievable subject to power constraint Eh [P(H)] < P, where P(H) is the waterfilling policy. 


Proof: Since each mini-slot is of long duration compared to the coherence time of the fading 
process ( H k ,Gk ), the coding scheme of lfl3ll can be used without the CSI of Eve in the first 
minislot of each slot. This can achieve secrecy capacity 


C s 


E H,G 



( 1 + HP{H)/al \ 
VI + GP(H)/o%) 


( 20 ) 


subject to the power constraint E h ,g [P(H)] < P, with I(W k ; Z k ) < ne. Now we can use the 
coding-decoding scheme of Section 3 to achieve the secrecy capacity equal to the main channel 
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capacity 


C 





HP(H)\ 1 

)y 


( 21 ) 


6. Conclusions 

In this paper we have achieved secrecy rate equal to the main channel capacity of a wiretap 
channel by using the previous secret messages as a key for transmitting the current message. We 
have shown that not only the current message being transmitted, but all messages transmitted in 
last JV] slots are secure w.r.t. all the outputs of the eavesdropper till now, where N x can be taken 
arbitrarily large. We have extended this result to fading wiretap channels when CSI of Eve may 
or may not be available to the transmitter. The optimal power control is water filling itself. 

7. Appendices 

8. Proofs of Lemmas 

Lemma 1\ The following holds 

I(yVk,i, Wfc-i,i, • • •, Wfc-jVip; Z i, Z 2l ..., Zk) < (Ay + l)ne. ( 22 ) 

Proof : We have, 

W 1,1,..., Wk-NxX, Zi, Z 2 , • • •, Zk) 

= I{Wk,i) Zi, Z 2 ,..., z k ) 

+ I(Wk~ 1,1; Zi, Z 2 ,..., Zk\Wk,i) + ... + 
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+ I{Wk-N u i', Zi, Z 2 , ■ ■ ■, Zk\Wk,i, ■ • •,, Wk-Nt+1,1)- (23) 

But 

I(W k x, Z 1 ,Z 2 ,...,Z k ) 

= I(W k y, Z kil ) + I(W kX , Z 1 ,..., Z k . u Zk,2\Z k ,l) 

<ne + 0, (24) 

because (Z 1 ,..., Z k _ i, Z fc>2 ) -L (Z^i, W k ,i), where X _L y denotes that random variable X is 
independent of Y. 

Next consider 

i(Wk-ix,z 1 ,z 2 ,...,z k \W k , 1 ) 

= i{W k - ltl -,z k _ 1A \W ktl ) 

+ /(Wfc-i,!; (Zi,..., Z k ) — Z k _i t i\W ki i, Z k _i i), (25) 

where (Z 1 ,..., Z k ) — Z k _ i ;1 denotes the sequence [Z 1 ,..., Z k ) without Z k _ 1 ^. However, 

i(W k - lX ,z k . hl \W kA ) 

= /(W fc _ 1 , 1 ; y fe -i,i) < ne. (26) 

Also, because (Zi,..., Z fc _ 2 ) is independent of (fy fc _i ;1 , Z fc _i ; i), 

-^(^fc- 1 , 1 ; (Zi, ■ ■ ■, Z k ) — Z k _i i\W k} i, Z k _i i) 
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— I{Wk- 1 , 1 ; Z i,..., Zk~2\Wk,i, Zk~ 1 , 1 ) 

+ I{Wk~ 1 , 1 ; Z fe , Z k _ 12 \WZ k _ 1 , 1 , Z 1; ... Z k _ 2 ) (27) 

= o + i(W k . lX , z M \W k ,i, z k _ hl ,z u ... z k _ 2 ) 

+ I{W k - 1 , 1 ; Z k)2 , Z k _i }2 \W kt i, Z fc _i,i, Zi,... Zfc_ 2 , Z M ). (28) 

Furthermore, since (FF fe _i,i, VF M , Z M , Z fc _i,i) _L (Zi,..., Z k _ 2 ) we have 

^(Wfc-i,ij Z k i\W kt i, Z k _i i, Z u ..., Z fc _ 2 ) 

= /(W fc _ 1 ;Z fc)1 |W M ,Z fc _ 1)1 ). (29) 

Using the fact that (W k _ i, Z fc _ lj i) _L (W k: i, Z fejl ) we can directly show that the right side equals 
zero. 

Let A denote the indices of the slots in which messages are transmitted which are used as 
keys for transmitting W k ,2 and W k - i j2 . Since 

(Z k , 2 , Z’fc_i )2 ) -H- (W, Wa) 

(kkfc,i, Z fc _i,i, Z^i, Zi,..., Zfc_ 2 ), (30) 

where A" <-> Y <-> Z denotes that {A", Y, Z} forms a Markov chain, we have 

I(W k - h i; Z k 2) Z fc _i )2 |W M , ^fc-i,i) -^i) • • • j Z k _ 2 , Z M ) 

< /(W fc _i,i, Z fc)2 , Z fc _i i2 |W fc) i, Z fc _i,i, 

Z !,•••, Z fc _ 2 , Z fc>1 ) 
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< I{Wk-l,l, wA'l Zk,2, Zk-1,2) 

(31) 

< I(Wk- i : i; -Zfc )2 , Zk- 1,2) + I(Wa] Zk,2i Zk—1,2 1 1,1) 

= 0 + J(WU; Z* >2 , Z fc _ 1>2 ) ( = } 0, (32) 

where (a) follows from (l30l) . ( b ) follows since (W^fc- 1 , 1 ,-Z'fc-ia) -L (W a, Z kj2 , Z k _ i i2 ) and (c) 
follows since _L Z fc)2 , Z fc _ 12 . 

From (HU), HU), HU), HU, 

I{W k -i,i; Z\, Z 2 , ■ ■ ■, Zk\Wk,i) < (33) 

We can similarly show that the other terms on the right side of © are also upper bounded 
by ne. This proves the lemma. □ 

Lemma 2: The following holds 

I{Wk,2i Wk- 1,2; • • ■ Wfc-JVi,2> Zi, ■ ■ ■ > Z k \Wk,ii ■ ■ ■ 1 Wk_ N 1 , 1 ) < Nine. (34) 

Proof: We have 

l(W k ,2,...,W k -jvi,2; Zi,...,Zk \w kA ,...,w k -Nu 1 ) 


--I(W k , 2,.. 

■ , W k -Ni,2'i Z i, . . 

■ , Zk- 

- Nl -l\W k A, . 

■ ■ , Wk-Ni,l) 


+ I(W kt2 , ■ 

i • • • > Wk-N lt 2', Z k - 

-Nj. i ■ ■ 

■ , Z k \W k ,i, ■ 

■ ■ , W k -Ni,l, Z 1, . 

■ ■jZk-N-i- 1)- (35) 


Since FF M , • • •, W , j fc _jv 1) i is independent of VF fei2 ,..., W k - Nl>2 , Zy,..., Z k _ Nl _ x , the first 
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term on the right equals 


I(Wk,2i Wk- 1 , 2 ) ■ ■ ■ , Wk-Ni,2] Zi, . . . , Zk-Nx-l) — 0 . 


(36) 


The second term in the RHS of (l35l) 


= I{W k ,2,...,W h — JVi,2j Z k _ Nl , ■ ■ • j Z k \W k ,i,...,W k 

—^ 1 ) ■ ■ • ) 

= I(W K2) ... ) W k —N\,2'i Z k —Ni,li ■ ■ ■ Z k ,i\w k ,w k —JVi,l) Zy, ■ ■ ■ ) 

+ /(W fc , 2 ,TF fc _ 1)2 ,...,TR fc —JVi,2J Zk-N u 2j • • • 5 • • • J 

^1) * * * 5 Zk — TVi — lj ZN\,l) • • • 5 (37) 


The first term on the right is zero because (VFfc ) 2 ,VFfc_i j2 , • • •, Wk-N lt 2 ) is independent of 
■ -,Zj(._jVi,i), (Wfcp,..., Wfc-jVi) and Zi,... Z k -N x - 1 - Also since (Wfcp,..., fFfc-jVi,i) 
and (Zfc )1 ,..., Z k _ N] l ) are independent of the other random variables in the second term on 
the right side, this term equals 

UWk,2,W k - 1 , 2 ,...,W k —iVi,2j Zfo, 2 5 • • • 5 Zfo— 7Vi,2 |Zi,..., Zfc_jv 1 —].)■ (38) 

For convenience we denote it as /(W 2 ; Z 2 |Zj) with hF 2 , Z 2 , Z x denoting the respective sequences 
of random variables. Since 


I(W 2 ; Z l5 Z 2 ) = J(W 2 ; Z,) + J(W 2 ; Z^Zy) 


= /(hF 2 ;Z 2 ) + /(hF 2 ;Z 1 |Z 2 ), (39) 
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and we have 

I(W 2 ,Zi) = 0 = I(W 2 -,Z 2 ), (40) 

and 

Z^{W U W A ,W 2 )<*Z 2 , (41) 

where Wi = (W fc , i,..., W k -N u i), we get 


I{W 2 -Z 2 \Z 1 ) ( = ) /(l? 2 ;Z 1 |Z 2 ) 

</(W ? 1 ,l? 2 ,fez 1 |Z 2 ) 

< IiW^W^W^Zi) 

= i(w 1 ;z 1 ) + i(w 2 ,w A] z 1 \w 1 ) 

— 0 + I(W 2l W A ; Zi) 

= I{W A -Z 1 ) + I{W 2 -Z 1 \W A ) 

(d) 

< iVine + 0 = iVine, (42) 

where (a) follow from (l40l) . ( b ) follows from ATI) (c) follows from Wi _L (W 2 ,W A ,Z 1 ), (d) 
follows from wiretap coding and the fact that the set A will not have larger cardinality than Ni, 
and W 2 JL (Z U W A ). 

Therefore 

I(W 2 ; Z 2 \Z!) < N in e. (43) 


From ( 1361) . (f37l) and ( 1431) . we get the lemma. 
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